[xen staging-4.17] oxenstored: Reset the watches trie on domain reconnect

[patchbot@xxxxxxx]

commit fae7e6082a58812fb03c02283edbb000ab93e7c6
Author:     Andrii Sultanov <andriy.sultanov@xxxxxxxxxx>
AuthorDate: Thu Aug 20 15:00:02 2026 +0000
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Wed Aug 26 17:51:38 2026 +0100

    oxenstored: Reset the watches trie on domain reconnect
    
    oxenstored maintains two datastructures about watches; one global trie, and
    one hashtable tracked per domain.  Both need keeping in sync, and right now
    the global trie is not emptied when a xenbus reconnect is requested.
    
    This is basically the same bug as XSA-330, commit 491a077ed4c5
    ("tools/ocaml/xenstored: delete watch from trie too when resetting 
watches"),
    just tickled via another path.
    
    Arrange for both Process.do_reset_watches() and Process.do_reconnect() to
    share a common codepath for the resetting of watches and transactions.
    Notably, this means that the latter now calls Connections.del_watches() 
which
    clears the global trie too.
    
    Connections.del_watches() already calls Connection.del_watches() so remove 
the
    re-clearing of the state from Connection.do_reconnect().
    
    Move History.trim() into reset_watches_and_transactions() so it's on the
    common path, and place it after removing the transactions rather than 
before.
    
    This is part of XSA-512 / CVE-2026-79604.
    
    Reported-by: David Korczynski <David@xxxxxxxxxxxxx>
    Fixes: 674ad2be409d ("xenstore: extend the xenstore ring with a 'closing' 
signal")
    Signed-off-by: Andrii Sultanov <andriy.sultanov@xxxxxxxxxx>
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Reviewed-by: Andrii Sultanov <andriy.sultanov@xxxxxxxxxx>
    (cherry picked from commit a2ca4f8b9890899ca89d6116002e7a9c5957d8c6)
---
 tools/ocaml/xenstored/connection.ml |  4 +---
 tools/ocaml/xenstored/process.ml    | 11 +++++++----
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/tools/ocaml/xenstored/connection.ml 
b/tools/ocaml/xenstored/connection.ml
index 54f7f76516..a91caabec6 100644
--- a/tools/ocaml/xenstored/connection.ml
+++ b/tools/ocaml/xenstored/connection.ml
@@ -148,13 +148,11 @@ let mark_as_bad con =
 let initial_next_tid = 1
 
 let do_reconnect con =
+       (* transactions and watches handled by caller *)
        Xenbus.Xb.reconnect con.xb;
        (* dom is the same *)
-       Hashtbl.clear con.transactions;
        con.next_tid <- initial_next_tid;
-       Hashtbl.clear con.watches;
        (* anonid is the same *)
-       con.nb_watches <- 0;
        con.stat_nb_ops <- 0;
        (* perm is the same *)
        ()
diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
index 33161da5eb..b2ee4d0adf 100644
--- a/tools/ocaml/xenstored/process.ml
+++ b/tools/ocaml/xenstored/process.ml
@@ -328,15 +328,18 @@ let do_isintroduced con _t domains _cons data =
                in
        if domid = Define.domid_self || Domains.exist domains domid then 
"T\000" else "F\000"
 
-(* only in xen >= 4.2 *)
-let do_reset_watches con _t _domains cons _data =
+let reset_watches_and_transactions cons con =
   Connections.del_watches cons con;
-  Connection.del_transactions con
+  Connection.del_transactions con;
+  History.trim ()
+
+let do_reset_watches con _t _domains cons _data =
+  reset_watches_and_transactions cons con
 
 let do_reconnect cons con =
   let domstr = Connection.get_domstr con in
   info "%s requests a reconnect" domstr;
-  History.trim ();
+  reset_watches_and_transactions cons con;
   Connection.do_reconnect con;
   info "%s reconnection complete" domstr
 
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.17